Lecture 179: Application Load Balancer
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：09:28
- 来源：Udemy Lecture 28555967
- Slide 数量：11
- 画面切换：00:46、01:44、02:38、03:33、04:28、04:58、05:26、06:13、07:02、08:13
扫描说明
逐条读取了 Udemy 页面中的 234 条英文 Transcript cue，并按时间轴扫描全长约 09:28 的视频。依据 Listener/Rule/Target Group、Layer 7 特性、Target Type、Subnet/IP 要求、Routing Condition、Path-based Routing、Query String Routing、User Authentication、TLS/SNI、Listener Rule 与 Target Group Weighting 划分为 11 个小节。截图均在 Transcript 侧栏关闭、播放器控件隐藏后复核，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Listener、Rule 与 Target Group
时间范围：00:00–00:46
总结 / Summary
中文
一个 ALB 可以有多个 Listener，每个 Listener 可以按顺序配置多个 Rule。Rule 把请求送往 Target Group；每个 Target Group 可包含多个 Target，并拥有独立 Health Check。同一 Target 技术上也可以加入多个 Target Group。
English
An ALB can have multiple listeners, and each listener can contain multiple ordered rules. A rule sends a request to a target group; each target group can contain multiple targets and has its own health check. A target can also technically belong to more than one target group.
Transcript
00:00 So now let's talk about
00:01 your application load balancer
00:03 and what you need to know from an exam perspective.
00:04 So, your ALB can have multiple listeners
00:07 and each listener can have one or more rules.
00:10 So in this example,
00:11 Listener 1 one has one rule
00:13 and the rule could be to send
00:15 traffic into a target group.
00:17 And a target group may have multiple targets.
00:20 It could be for example, EC2 Instances,
00:22 and also it could have health checks.
00:25 And here's an example of a health check
00:26 on your target group.
00:28 Now, as I said,
00:29 listeners can have multiple rules
00:30 and we'll see this in this lecture.
00:32 And the idea is that, well,
00:33 these rules can route to different target groups
00:36 and each target group may have multiple targets.
00:39 Sometimes targets are even shared between target groups,
00:41 all those, a common practice,
00:44 and each target group again has health checks.
2. ALB 的 Layer 7 能力
时间范围：00:46–01:44
总结 / Summary
中文
ALB 工作在 Layer 7，支持 HTTP、HTTPS、WebSocket、HTTP/2 与 gRPC。它能把多个 HTTP Application 汇聚到一台 ALB，并借助 Dynamic Port Mapping 把同一 Host 上不同 Port 的 Container 分别作为 Target。Rule 还可直接返回 Fixed HTTP Response，或把 HTTP Redirect 到 HTTPS。
English
ALB operates at Layer 7 and supports HTTP, HTTPS, WebSocket, HTTP/2, and gRPC. It can consolidate multiple HTTP applications behind one ALB and use dynamic port mapping to target containers on different ports of the same host. A rule can also return a fixed HTTP response or redirect HTTP to HTTPS.
Transcript
00:46 So the ALB will operate at the Layer 7,
00:49 which is for HTTP and HTTPS, WebSockets,
00:53 HTTP 2 and the gRPC protocols.
00:56 And this will allow you to do load balancing
00:58 across multiple HTTP based applications or target groups.
01:03 The load balancing can also happen
01:05 on a single target on multiple ports.
01:08 So for example, if you have an EC2 Instance
01:10 that has 10 containers running on it,
01:12 then thanks to a dynamic port mapping feature,
01:15 the ALB is able to send traffic
01:17 into each of these containers on the right parts.
01:20 There's also support for sending directly
01:23 from the ALB, a custom HTTP response
01:26 in case you don't even want the traffic
01:28 to reach your EC2 or your target group as a whole.
01:32 And it supports redirects. For example,
01:34 if you want it to automatically secure
01:36 your HTTP traffic into HTTPS,
01:38 you can support redirecting any requests
01:40 that is HTTP based into an HTTPS request.
3. 四种 ALB Target Type
时间范围：01:44–02:38
总结 / Summary
中文
Target Group 可以包含 EC2 Instance、ECS Task、Lambda Function 或 Private IP Address。EC2 可由 Auto Scaling Group 管理；ECS 与 Dynamic Port Mapping 配合；发往 Lambda 的 HTTP Request 会转换为 JSON Event；Private IP Target 可指向 Peered VPC 中的 EC2，或经 Direct Connect/VPN 连接的 On-premises Server。
English
A target group can contain EC2 instances, ECS tasks, Lambda functions, or private IP addresses. EC2 can be managed by an Auto Scaling Group; ECS works with dynamic port mapping; HTTP requests to Lambda are translated into JSON events; and private IP targets can represent EC2 in a peered VPC or on-premises servers reached through Direct Connect or VPN.
Transcript
01:44 Okay, so now let's talk about your target groups.
01:47 So it could be made of multiple things.
01:49 It could be made of EC2 Instances, and in which case,
01:52 these instances can live in an auto scaling group.
01:55 So this is for HTTP traffic.
01:57 Then we have ECS task and the means
01:59 that the tasks are managed by ECS itself.
02:02 And we have HTTP traffic again, Okay.
02:05 And this is cool because then
02:07 this will leverage directly
02:08 with dynamic port mapping feature of the ALB.
02:12 And then we also have Lambda functions.
02:14 So in this case, any HTTP traffic
02:17 is going to be converted into a JSON event
02:19 that will be passed on to your lambda functions.
02:22 We also have IP addresses and in which case,
02:25 these IP addresses must be privates.
02:27 So there could be EC2 instances
02:29 in peered VPC or on-premise servers
02:32 accessed over a private connectivity,
02:34 So either direct connect or VPN connection.
4. Weighted Target Group、Health Check 与 Subnet 容量
时间范围：02:38–03:33
总结 / Summary
中文
ALB 支持 Weighted Target Group，可在多个版本之间按比例分流并进行 Blue/Green Deployment。Health Check 支持 HTTP 或 HTTPS，但不支持 WebSocket。考试常考容量限制：每个 ALB Subnet 至少要是 /27，并保留至少 8 个 Free IP；一个 ALB 跨所有 Subnet 最多使用 100 个 IP Address。
English
ALB supports weighted target groups for proportional traffic splitting and blue/green deployments. Health checks support HTTP or HTTPS but not WebSocket. Important exam limits are that every ALB subnet must be at least /27 with at least eight free IP addresses, and one ALB can use at most 100 IP addresses across all subnets.
Transcript
02:38 It supports weighted target groups,
02:40 that means that you can send traffic
02:42 to multiple target groups at a time.
02:44 We'll see this in this lecture as well.
02:46 This will allow you for example,
02:47 to test multiple versions of your application
02:49 or to perform blue-green deployments.
02:52 The types of health checks can be HTTP or HTTPS,
02:55 WebSocket is not yet supported.
02:57 And each subnet must have a minimum,
02:59 and this is very very important,
03:01 a minimum of /27 size for the cider
03:05 and at least eight free IP addresses,
03:08 and across all subnets,
03:10 a maximum of 100 IP addresses will be used per, per ALB.
03:15 So this is very important because you need
03:17 to remember that the subnets must have a minimum size,
03:20 must have a minimum of free IP addresses.
03:23 And this is, and you need to remember again,
03:24 the number of maximum IP addresses,
03:26 because these are common troubleshooting things
03:28 that the exam may test you on.
03:30 So remember the last two absolutely.
5. Content-based Routing 条件
时间范围：03:33–04:28
总结 / Summary
中文
ALB 可依据 URL Path、Hostname、Query String、HTTP Header 与 Source IP 将请求送往不同 Target Group。Host 条件支持完整域名和 Wildcard，例如 one.example.com、*.example.com；Query String 则可匹配 id=123、order=false 等参数。这种内容感知路由也是 ALB 适合 ECS Microservice 的关键原因。
English
ALB can route requests to different target groups using URL path, hostname, query string, HTTP headers, and source IP. Host conditions support exact names and wildcards such as one.example.com and *.example.com, while query strings can match parameters such as id=123 and order=false. This content-aware routing is a major reason ALB fits ECS microservices.
Transcript
03:33 Okay. Now let's talk about target groups.
03:36 So we can route two target groups on multiple aspects.
03:39 We can route based on the path of the URL,
03:41 for example, / reserves or / posts,
03:44 we can route based on the host name
03:46 of the incoming request, for example,
03:48 one.com and other.example.com
03:52 or *.example.com and then example.com just on its own.
03:56 We can route based on Query Strings parameters,
03:59 HTTP Headers, Source IP address.
04:01 So here's an example for Query String parameters.
04:03 So id=123 and order=false.
04:07 And as I mentioned before,
04:08 well the ALB should be a great fit
04:10 regarding your Amazon ECS micro services,
04:13 because it's going to leverage the dynamic
04:16 port feature mapping from the ALB.
04:20 That would not be possible to use if you were
04:23 to use a CLB because CLB does not have
04:26 a port mapping feature.
6. Path-based Routing
时间范围：04:28–04:58
总结 / Summary
中文
Path-based Rule 可让同一个 ALB 根据 URL Path 选择不同 Backend，例如 /user 进入由 EC2 构成的 User Target Group，而 /search 进入 Lambda Target Group。不同 Application 因而共享一个入口，却仍有独立 Target 与 Health Check。
English
A path-based rule lets one ALB select different backends by URL path—for example, /user can reach an EC2-based user target group while /search reaches a Lambda target group. Different applications therefore share one entry point while keeping independent targets and health checks.
Transcript
04:28 Okay, so now let's talk about Path-based Routing.
04:30 So this is very simple.
04:31 Here's an ALB that has two target groups.
04:34 The first one is a target group from EC2 Instances.
04:37 And then we have a second one,
04:38 which is maybe a target group made of Lambda functions.
04:41 And so what we want to do is that we want
04:43 to route all the users that will go
04:45 to the Route:/user into the user's target group
04:49 and route all the users on the search target group
04:52 into our Lambda target group.
04:54 So we can define path based routing using this method.
7. Query String Routing 到 AWS 与 On-premises
时间范围：04:58–05:26
总结 / Summary
中文
Query String Rule 可以把 platform=Mobile 送往 AWS EC2 Target Group，把 platform=Desktop 送往使用 Private IP Routing 的 On-premises Target Group。ALB 因而能在 Hybrid Architecture 中按应用属性选择 Cloud 或本地 Backend。
English
A query-string rule can send platform=Mobile to an AWS EC2 target group and platform=Desktop to an on-premises target group using private IP routing. ALB can therefore select cloud or local backends by application attributes in a hybrid architecture.
Transcript
04:58 We can also use for example,
04:59 Query String or Parameters Routing.
05:01 So here's an example.
05:03 We have a target group on AWS made of EC2 Instances,
05:06 and we have a second target group.
05:08 This one is made of On-Premise servers.
05:10 So this is going to use a private IP routing.
05:13 And here we're saying that anything
05:15 that has the query string and platform=Mobile
05:17 should be sent to the first target group.
05:20 And the Query string and platform=Desktop
05:22 should be sent to the second target group.
8. 在 ALB 层完成 User Authentication
时间范围：05:26–06:13
总结 / Summary
中文
ALB 能在转发请求前认证 User，把 Authentication Logic 从 Application 移到入口层。它可通过 Amazon Cognito 集成 User Pool 和 Identity Provider，也可接入 Microsoft Active Directory、OIDC、SAML、LDAP、OpenID，以及 Amazon、Facebook、Google 等 Social Identity Provider。
English
ALB can authenticate users before forwarding requests, moving authentication logic out of the application and into the entry layer. Through Amazon Cognito it can integrate user pools and identity providers, including Microsoft Active Directory, OIDC, SAML, LDAP, OpenID, and social providers such as Amazon, Facebook, and Google.
Transcript
05:26 So now let's have a look at some ALB features.
05:29 So first of all, the ALB is able to authenticate
05:32 your users before routing the request
05:35 to the registered targets in your target group.
05:37 So that means that for example, you can have
05:38 an integration between your ALB and Amazon Cognito
05:42 to make sure that your users are indeed logged in
05:45 using Cognito before the request is passed on
05:48 to your EC2 Instance and effectively
05:50 what this is doing is that you're moving
05:51 the authentication logic out of your application,
05:54 into the ALB, and you're preventing your EC2 Instances
05:58 from having to deal with that complexity.
06:00 It can also be a Microsoft Active Directory or OIDC,
06:03 SAML, LDAP, OpenID.
06:05 It can be social identity providers such as Amazon,
06:07 Facebook, and Google.
06:08 So you have lots of different ways
06:09 of authenticating users, but all of those
06:11 are integrated with your ALB.
9. TLS Certificate、SNI 与前后端加密
时间范围：06:13–07:02
总结 / Summary
中文
HTTPS Listener 使用 ACM Certificate 在 ALB 完成 SSL/TLS Termination，并通过 SNI 支持多个证书与 Hostname。终止后可向 Target 发送 HTTP；若内部连接仍用 HTTPS，则 Target 也必须安装自己的 Certificate。HTTP Listener 同样可以选择 HTTP 或 HTTPS Backend。
English
An HTTPS listener uses an ACM certificate to terminate SSL/TLS on the ALB and supports multiple certificates and hostnames through SNI. After termination it can send HTTP to the target; if the internal connection remains HTTPS, the target must also have its own certificate. An HTTP listener can likewise use either an HTTP or HTTPS backend.
Transcript
06:13 You can also load SSl or TLS
06:16 or SSL certificates onto your ALB.
06:18 And so that you need to have multiple listeners
06:20 and you have an SNI, server name indication
06:22 feature on the application button.
06:24 So what this means that you can terminate
06:26 your connections directly on your ALB
06:29 and using ACM, the ACM integration,
06:32 and then send un-encrypted traffic, for example,
06:34 to your EC2 Instances.
06:36 So this is a very simple table.
06:37 We have two types of Listener, either HTTP or HTTPS.
06:41 If you do enable HTTPS as a listener on your ALB,
06:44 you will need obviously to use ACM.
06:46 And then internally, again,
06:48 the same as before for the CLB,
06:49 you can send HTTP or HTTPS traffic to your EC2 Instance,
06:53 but in which case, if you do send
06:55 HTTPS traffic to your EC2 Instances,
06:57 you need to make sure they have
06:58 their own certificates loaded on them.
10. Listener Rule 的顺序、Action 与 Condition
时间范围：07:02–08:13
总结 / Summary
中文
Listener Rule 按顺序处理，最后一条是 Default Rule。Action 包括 Forward、Redirect 与 Fixed-response；Condition 可组合 host-header、http-request-method、path-pattern、source-ip、http-header 和 query-string。没有前序 Rule 匹配时才执行 Default Rule。
English
Listener rules are processed in order, with the last rule acting as the default. Actions include forward, redirect, and fixed-response. Conditions can combine host-header, http-request-method, path-pattern, source-ip, http-header, and query-string. The default rule runs only when no earlier rule matches.
Transcript
07:02 Okay, now let's talk about the Listener Rules.
07:04 So a listener can have multiple rules,
07:07 one, two, and three, and then the default rule.
07:09 And so each rule will have a specific action.
07:12 For example, Rule 1,
07:13 based on some criteria, for example,
07:16 for path or for query string parameters
07:18 is saying, hey, redirect to Target Group 1,
07:21 Rule 2 is going to say
07:22 redirect to Target Group 2, and then, and so on.
07:25 And then the default rule is saying,
07:26 hey, no matter what happens,
07:28 if none of the rules are matched,
07:30 please redirect to Target Group 3.
07:33 So they're processing orders.
07:34 So the last one is going to be the default rule
07:36 and it supports multiple actions,
07:37 for example, forward, redirect or fixed-response.
07:41 So forward is to send the traffic into a target group.
07:44 Redirect is to, for example,
07:45 redirect the traffic from HTTP to HTTPS
07:48 and fixed response is to send, for example,
07:50 a fixed 404 response as your last role,
07:53 if in case, well, this was a bad request.
07:56 So the rules conditions are going to be
07:58 host-headers, http-request-method, path-pattern,
08:02 source-ip, http-header and query-string.
08:05 So these are all the conditions you can have
08:07 and combine to make sure that a rule
08:09 is matched specifically for a specific target group.
11. Target Group Weighting 与 Blue/Green Deployment
时间范围：08:13–09:28
总结 / Summary
中文
单条 Forward Rule 可包含多个 Target Group 并为每组设置 Weight。例如 Blue Group 权重 8、Green Group 权重 2，约 80% 与 20% 的流量分别进入旧版和新版。逐步提高 Green Weight 可以验证新版本并平滑完成 Blue/Green Deployment。
English
A single forward rule can contain multiple target groups with a weight for each. For example, weights of 8 for the blue group and 2 for the green group send roughly 80% and 20% of traffic to the old and new versions. Gradually increasing the green weight validates the new version and enables a smooth blue/green deployment.
Transcript
08:13 Okay, now let's talk about target group weighting.
08:15 So this is very helpful
08:16 for blue-green deployments and so on.
08:19 So we can specify multiple target groups
08:22 to send traffic to, on a single rule.
08:25 The idea is that you can test multiple versions
08:27 of your application for a rule
08:29 and then perform blue/green deployments.
08:31 This allows you to control how much traffic
08:33 is going to go to a specific target group.
08:36 And then you can test whether or not
08:37 the target group is working effectively.
08:40 So in this example, we have the users
08:42 connecting to an ALB. The ALB has one rule,
08:44 and this rule is saying that 80% of the traffic
08:49 is supposed to go to the Target Group 1,
08:52 which is the blue target group.
08:53 And two, as a weight, So 20% of the traffic
08:56 is supposed to go to my Target Group 2, so effectively
09:00 we're doing is that we're sending 80% and 20%.
09:03 And imagine that the Target Group 2
09:06 is your new application version.
09:07 Then we are getting a gradual shift
09:10 of weights onto it, and we can test whether or not
09:12 well the Target Group 2 is functioning as expected,
09:16 and this is done from within a single rule.
09:18 So this allows you to do blue-green deployments
09:20 directly on your ALB.
09:23 So that's it for your high level overview of ALB.
09:25 I hope you liked it.
09:26 And I will see you in the next lecture.
整讲总结 / Overall Summary
中文
ALB 是 Layer 7 Load Balancer，以 Listener Rule 将 HTTP、HTTPS、WebSocket、HTTP/2 或 gRPC 流量按 Path、Host、Header、Query String、Method 或 Source IP 分配到 EC2、ECS、Lambda 或 Private IP Target。它还支持 Dynamic Port Mapping、固定响应、Redirect、Cognito Authentication、ACM/SNI 以及 Weighted Target Group。重点记住每个 Subnet 至少 /27 且有 8 个 Free IP、每个 ALB 最多使用 100 个 IP，以及 Rule 按顺序执行、最后一条为 Default。
English
ALB is a Layer 7 load balancer that uses listener rules to distribute HTTP, HTTPS, WebSocket, HTTP/2, or gRPC traffic by path, host, header, query string, method, or source IP to EC2, ECS, Lambda, or private IP targets. It also supports dynamic port mapping, fixed responses, redirects, Cognito authentication, ACM/SNI, and weighted target groups. Remember the exam limits of /27 plus eight free IPs per subnet and 100 IPs per ALB, along with ordered rule processing and the final default rule.
返回顶部 ↑